SACS-002 is Saudi Aramco’s cybersecurity standard for third-party vendors. Since 2021, it has been a mandatory requirement for all IT, OT and digital services vendors. Here is everything you need to know.

What is SACS-002?

SACS-002 (Saudi Aramco Cybersecurity Standard 002) is a vendor cybersecurity compliance framework aligned with the Saudi National Cybersecurity Authority’s (NCA) Essential Cybersecurity Controls (ECC). It was introduced following several high-profile cyberattacks on oil and gas infrastructure in the region.

Who Needs SACS-002 Certification?

Any vendor supplying IT hardware or software, managed IT services, OT (operational technology) systems, cloud services, telecom services, or digital consulting to Saudi Aramco must be SACS-002 certified. This includes companies providing: ERP systems, cybersecurity services, network infrastructure, IoT devices, SCADA systems, and data analytics.

What Does SACS-002 Compliance Require?

The standard covers 5 main cybersecurity domains:

• Governance: Information security policies, roles and responsibilities
• Defence: Network security, endpoint protection, access control
• Resilience: Backup, disaster recovery, incident response
• Third-Party Risk: Supplier and subcontractor security management
• Compliance: Ongoing monitoring and audit mechanisms

The Assessment Process

Vendors must undergo a gap analysis against NCA ECC controls, implement any required remediation, and then commission a third-party assessment from an Aramco-approved assessor. The assessor’s report and compliance attestation are submitted through the SACS portal as part of your vendor registration.

How Analytix Helps

Analytix manages the complete SACS-002 journey: initial gap analysis, remediation planning and implementation support, evidence documentation, third-party assessor coordination, and submission of the compliance pack to Aramco. Our clients typically achieve compliance in 6–12 weeks depending on their starting position.

Start your SACS-002 compliance process today — free gap assessment available →